TOOLS_OAUTH_NO_REFRESH_TOKEN

Issue

This is a warning, not an error. Connecting the tool worked, but the app returned a short-lived access token without a refresh token. Glean can't renew the token on its own, so everyone who uses the tool has to connect again each time their access expires, often every hour.

Most providers issue a refresh token only when the OAuth client is set up for it, or when Glean asks for offline access.

Resolution

Only an admin can fix this. Change the app's OAuth client, or the tool's scopes, so that the app issues refresh tokens:

• Microsoft Entra ID, Okta, Auth0, and other OpenID Connect providers: add the offline_access scope to the tool's scopes in Admin console → Platform → Tools.
• Okta: in the app integration's settings, also enable the Refresh Token grant type.
• Auth0: also turn on Allow Offline Access for the API.
• Other providers: check the provider's documentation for how to get a refresh token from the authorization code flow.

For a connector set up in Admin console → Platform → Connectors, add the scope in the Scopes field on the connector's setup page. If the setup page has no Scopes field, Glean sets the connector's scopes. Contact Glean Support.

Then connect the tool again, or click Connect on the connector's setup page. If the warning no longer appears, the app issued a refresh token.

For token lifetimes by provider, see the Tools OAuth reference.

For additional assistance, contact Glean Support.